CISA Urges Immediate Patching of Exploited SharePoint Flaws

The U.S. Cybersecurity and Infrastructure Security Agency has issued urgent warnings regarding a cluster of actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, prompting federal agencies and organizations to apply patches and implement hardening measures. The agency confirmed that attackers are leveraging these flaws to gain unauthorized access, execute remote code, and deploy malware on compromised systems.

On July 14, CISA published an alert detailing active exploitation of three specific vulnerabilities: CVE-2026-32201, a spoofing flaw; CVE-2026-45659, a remote code execution vulnerability; and CVE-2026-56164, a privilege elevation flaw. These affect all supported on-premises SharePoint Server versions, including Subscription Edition, 2019, and 2016. According to the agency, threat actors are combining these vulnerabilities to breach systems, steal Internet Information Services machine keys, use deserialization techniques to establish persistence, and ultimately deploy malware.

The situation escalated on July 15 when Microsoft revised its security advisory to confirm that a fourth, newly patched vulnerability, CVE-2026-58644, is also being exploited...